Welcome to the Cloudflare Community.
What type of traffic are you running on that endpoint? Is it V2RAY or similar VPN activity?